Malicious code in easydsbots (npm)

The easydsbots npm package (version 1.0.0) declares a postinstall script that runs 'sudo node install.js', escalating privileges to root during installation. The install.js script is heavily obfuscated using techniques such as rotated string arrays, hex-encoded property lookups, control-flow flattening, and self-defending stubs to conceal its behavior. The runtime code (index.js) is similarly obfuscated and decodes base64 strings at runtime. It checks for the 'INVOCATION_ID' environment variable, which is set when launched by systemd, and depends on the 'node-linux' library to register systemd or init.d service units. This combination strongly indicates the package attempts to install a root-persistent daemon on the host system during npm install, representing a malicious package designed for stealthy persistence.

Installation of easydsbots version 1.0.0 can lead to unauthorized root-level code execution on the host system. The malicious postinstall script runs with escalated privileges, potentially allowing attackers to install persistent daemons that survive reboots and maintain control over the compromised system. This poses a significant risk of system compromise, data theft, or further malware deployment.

No official patch or remediation is currently documented for this package. Users should avoid installing easydsbots version 1.0.0. Audit existing systems for presence of this package and remove it if found. Monitor for unauthorized systemd or init.d service files that may have been installed. Exercise caution with npm packages that execute scripts with elevated privileges during installation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.